Skip to content

Fix verification when key specifies hash algorithm #168

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 7 commits into
base: develop
Choose a base branch
from
Open

Fix verification when key specifies hash algorithm #168

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
66271ed
Fix verification when key specifies hash algorithm
abeverley Feb 3, 2024
8323d34
Sanity check inputs to arc_parse_algorithm
abeverley Feb 4, 2024
00345b1
Check nid is correctly defined after algorithm parse
abeverley Feb 4, 2024
6be659f
Handle missing algorithm gracefully
abeverley Feb 4, 2024
8499dc6
Check status from arc_parse_algorithm
abeverley Feb 4, 2024
6edc760
Simplifed error handling
abeverley Feb 5, 2024
043a8d1
Add assert for function input
abeverley Feb 5, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
60 changes: 50 additions & 10 deletions libopenarc/arc.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -289,6 +289,48 @@ arc_key_hashesok(ARC_LIB *lib, u_char *hashlist)
/* NOTREACHED */
}

/*
** ARC_PARSE_ALGORITHM -- parse an algorithm and set the msg hash and key,
** as well as set the message digest algorithm for
** RSA_verify in the variable nid
**
** Parameters:
** msg -- ARC_MESSAGE handle
** alg -- string containing the algorithm to parse
** nid -- variable to write the message digest algorithm
**
** Return value:
** An ARC_STAT_* constant.
*/

ARC_STAT
arc_parse_algorithm(ARC_MESSAGE *msg, u_char *alg, int *nid)
{
arc_alg_t algtype;

algtype = arc_name_to_code(algorithms, alg);

if (algtype == ARC_SIGN_RSASHA1)
{
msg->arc_hashtype = ARC_HASHTYPE_SHA1;
msg->arc_keytype = ARC_KEYTYPE_RSA;
*nid = NID_sha1;
}
else if (algtype == ARC_SIGN_RSASHA256)
{
msg->arc_hashtype = ARC_HASHTYPE_SHA256;
msg->arc_keytype = ARC_KEYTYPE_RSA;
*nid = NID_sha256;
}
else
{
arc_error(msg, "unknown or invalid algorithm");
return ARC_STAT_BADALG;
}

return ARC_STAT_OK;
}

/*
** ARC_GENAMSHDR -- generate a signature or seal header field
**
Expand Down Expand Up @@ -1965,6 +2007,10 @@ arc_validate_msg(ARC_MESSAGE *msg, u_int setnum)
msg->arc_selector = arc_param_get(kvset, "s");
msg->arc_domain = arc_param_get(kvset, "d");

/* store algorithm in msg, needed for arc_get_key() */
alg = arc_param_get(kvset, "a");
arc_parse_algorithm(msg, alg, &nid);

/* get the key from DNS (or wherever) */
status = arc_get_key(msg, FALSE);
if (status != ARC_STAT_OK)
Expand Down Expand Up @@ -2039,11 +2085,6 @@ arc_validate_msg(ARC_MESSAGE *msg, u_int setnum)
return ARC_STAT_CANTVRFY;
}

alg = arc_param_get(kvset, "a");
nid = NID_sha1;
if (alg != NULL && strcmp(alg, "rsa-sha256") == 0)
nid = NID_sha256;

rsastat = RSA_verify(nid, hh, hhlen, sig, siglen, rsa);

RSA_free(rsa);
Expand Down Expand Up @@ -2119,6 +2160,10 @@ arc_validate_seal(ARC_MESSAGE *msg, u_int setnum)
msg->arc_selector = arc_param_get(kvset, "s");
msg->arc_domain = arc_param_get(kvset, "d");

/* store algorithm in msg, needed for arc_get_key() */
alg = arc_param_get(kvset, "a");
arc_parse_algorithm(msg, alg, &nid);

if (msg->arc_selector == NULL)
{
arc_error(msg, "seal at i=%u has no selector", setnum);
Expand Down Expand Up @@ -2191,11 +2236,6 @@ arc_validate_seal(ARC_MESSAGE *msg, u_int setnum)
return ARC_STAT_INTERNAL;
}

alg = arc_param_get(kvset, "a");
nid = NID_sha1;
if (alg != NULL && strcmp(alg, "rsa-sha256") == 0)
nid = NID_sha256;

rsastat = RSA_verify(nid, sh, shlen, sig, siglen, rsa);

RSA_free(rsa);
Expand Down
1 change: 1 addition & 0 deletions libopenarc/arc.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,7 @@ typedef int ARC_STAT;
#define ARC_STAT_KEYFAIL 11 /* key retrieval failed */
#define ARC_STAT_MULTIDNSREPLY 12 /* multiple DNS replies */
#define ARC_STAT_SIGGEN 13 /* seal generation failed */
#define ARC_STAT_BADALG 14 /* unknown or invalid algorithm */

/*
** ARC_CHAIN -- chain state
Expand Down